VULNERABILITY INTELLIGENCE
CVE-2025-4558
CVSS score9.8 CRITICAL
EPSS probability0.53%
CISA KEVNot currently listed
Published2025-05-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system.
Weakness classification
- twcert@cert.org.tw: CWE-620